feat: make DVD playback a classroom surface, not a media player

Pressing DVD now enters DVD mode rather than opening VLC. VLC is still
the backend, because its dvdnav module is what decodes disc menus and
nothing else on Debian does that reliably, but nothing a person can see
or press belongs to it any more.

classroom-dvd-session owns the whole thing. It puts a full-screen black
layer-shell surface up the moment the button is pressed, starts VLC
behind it, and drops it once playback is actually on screen — so the
harsh cut from wallpaper to VLC's black window is gone, and no partial
VLC window or reserved dock strip is ever visible. A deadline drops the
surface regardless, because DVD mode must never leave a black screen
with nothing behind it.

The controls are a classroom bar on the overlay layer, the one layer
sway draws above a fullscreen window. It slides up when the pointer
reaches the bottom of the screen and hides again shortly after it
leaves. It is drawn from the dock's own stylesheet at the room's UI
scale, so it is the same surface, the same radius and the same white
icons. While hidden it only accepts the pointer in a thin strip along
the bottom edge, so a click on a disc menu goes to the disc.

The bar reaches VLC through an HTTP interface on loopback behind a
password generated per session, sending hotkey *actions* by name. That
is what makes the next part possible.

All 108 hotkeys VLC 3.0.23 defines are unset, then Space, Esc and the
arrow keys plus Enter are bound. Crop, aspect ratio, subtitles, audio
tracks and deinterlacing are no longer reachable by pressing a key at
random, and the arrow keys no longer change VLC's volume — the
television owns volume, and CEC will own it properly later.

Esc quits instead of leaving fullscreen. There is nothing to leave, and
leaving it was what stranded people on a black VLC window. Close, Eject
and Esc all ask VLC to quit and escalate to SIGTERM then SIGKILL if it
does not; when VLC exits by any route, including a crash, the session
ends and the classroom desktop comes back.

Verified against VLC 3.0.23 on Trixie: every argument accepted, every
control action accepted over the control interface, a wrong password
refused, and quit exiting cleanly. The surfaces were rendered under a
headless sway and screenshotted to check the bar against the dock.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/testing.md

@@ -119,12 +119,34 @@ With `DVD_ENABLED=true`:
 - [ ] Closing the player works
 - [ ] Ejecting is detected, the icon goes back
 - [ ] Reinserting is detected again
-- [ ] VLC opens fullscreen, dark, with no menu bar, no orange cone and
-      no sway title bar
-- [ ] The fullscreen controller still appears on mouse movement
 - [ ] Commercial CSS disc plays without anyone having run codec setup
       by hand
 
+### DVD mode
+
+- [ ] Pressing DVD goes black immediately — no wallpaper, no dock, no
+      partial VLC window at any point
+- [ ] Video or the disc menu appears inside that black surface
+- [ ] No VLC chrome anywhere: no menu bar, no fullscreen controller,
+      no cone, no sway title bar
+- [ ] Wallpaper is never visible around VLC
+- [ ] Moving the mouse to the bottom slides the classroom bar up
+- [ ] It hides again shortly after the mouse leaves it
+- [ ] While hidden, clicking a disc menu item near the bottom still
+      reaches the menu
+- [ ] Play/pause toggles and the icon follows the actual state
+- [ ] Previous and next chapter work
+- [ ] The menu button returns to the disc menu
+- [ ] Space pauses; arrow keys and Enter navigate the disc menu
+- [ ] Arrow keys do **not** change volume, and no key reaches crop,
+      aspect ratio, subtitles, audio tracks or deinterlacing
+- [ ] Esc leaves DVD mode cleanly, with no black window left behind
+- [ ] Close leaves DVD mode cleanly
+- [ ] Eject leaves DVD mode and opens the tray
+- [ ] Killing VLC by hand also returns to the classroom desktop
+- [ ] Pressing DVD twice quickly does not start two sessions
+- [ ] The bar is sized by UI_SCALE like the dock
+
 ## OTA
 
 - [ ] `./update_canary.sh` publishes package first, manifest last